PT0-003 · Question #159
A penetration tester finds that an application responds with the contents of the /etc/passwd file when the following payload is sent: Which of the following should the tester recommend in the report…
The correct answer is C. Implement an XML firewall to prevent XXE. An XML firewall is the most comprehensive solution specifically designed to inspect, filter, and block malicious XML content including XXE (XML External Entity) attacks at the application layer before it reaches the backend. Since the payload described is an XXE attack…
Question
A penetration tester finds that an application responds with the contents of the /etc/passwd file when the following payload is sent:
Which of the following should the tester recommend in the report to best prevent this type of vulnerability?
Options
- AImplement input validation to restrict XML entities.
- BImplement an allow list to prevent file system access.
- CImplement an XML firewall to prevent XXE.
- DImplement an intrusion detection system (IDS) to detect XXE attempts.
How the community answered
(18 responses)- A6% (1)
- B17% (3)
- C72% (13)
- D6% (1)
Explanation
An XML firewall is the most comprehensive solution specifically designed to inspect, filter, and block malicious XML content including XXE (XML External Entity) attacks at the application layer before it reaches the backend. Since the payload described is an XXE attack (exploiting XML external entity processing to read /etc/passwd), implementing an XML firewall provides purpose-built protection that understands XML schema and can enforce strict XML processing policies. This is the best preventative control because it operates at the protocol level and can block the entire class of XXE vulnerabilities.
Topics
Community Discussion
No community discussion yet for this question.